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Summary  Report  on  the  Joint  Review  of  Selected  DoD 
Purchase  Card  Transactions 


Executive  Summary 


Who  Should  Read  This  Report  and  Why?  Policy  makers,  senior  managers,  purchase 
card  program  managers,  approving  offieials,  and  eardholders  should  read  this  report  to 
help  improve  any  defieiencies  in  the  internal  control  structure  of  the  DoD  Purchase  Card 
Program.  This  report  eites  examples  of  potentially  inappropriate  and  fraudulent  use  of 
purehase  cards  by  DoD  cardholders.  The  potentially  inappropriate  and  fraudulent  use 
was  detected  using  data  mining  teehniques,  whieh  support  data  mining  as  a  control 
mechanism  of  identifying  purehase  card  transactions  with  a  higher  probability  of  being 
fraudulent,  wasteful,  or  abusive. 

Background.  This  report  addresses  the  requirement  in  seetion  1007  of  the  National 
Defense  Authorization  Aet  for  FY  2003  that  the  Inspector  General  of  the  Department  of 
Defense  perform  periodie  audits  of  purchase  eard  use.  The  purchase  card  is  a 
commercial  charge  card  available  to  Federal  ageneies  to  pay  for  official  Government 
purehases.  The  DoD  Purchase  Card  Program  Office  reported  that  in  FY  2002,  about 
214,000  DoD  eardholders  used  the  purehase  card  to  make  approximately  1 1  million 
purehases  valued  at  $6.8  billion. 

In  Deeember  2001,  the  Office  of  the  Inspector  General  of  the  Department  of  Defense,  the 
Defense  Finance  and  Aecounting  Service,  and  the  DoD  Purehase  Card  Joint  Program 
Management  Offiee  agreed  to  initiate  an  automated  oversight  program  for  determining 
whether  anomalies  that  indieate  potential  fraud,  waste,  and  abuse  in  purchase  eard 
transactions,  could  be  detected  using  data  mining  teehniques.  Business  rules  that 
identified  potentially  inappropriate  transactions  were  applied  to  the  millions  of  purchase 
card  transactions.  The  process  ultimately  resulted  in  seleetion  of  1,357  purchase 
cardholders  for  an  in-depth  review.  The  Offiee  of  the  Inspeetor  General  then  provided  to 
each  of  the  Services  and  the  Defense  ageney  auditors  or  investigators  a  eardholder 
profile.  The  profile  eontained  flagged  transaetions  as  well  as  the  transactions  the 
cardholders  made  from  Oetober  1,  2000,  through  December  31,  2001. 

Results.  The  Serviees  and  the  Defense  agencies  performed  an  in-depth  review  of 
purehase  card  transactions  for  1,357  purchase  eardholders  identified  through  data  mining 
techniques  and  determined  that  182  cardholders  potentially  used  their  purehase  cards 
inappropriately  or  fraudulently.  As  a  result,  the  182  eardholders  expended  about 
$5  million  in  scarce  resources  on  potentially  fraudulent  and  inappropriate  transaetions. 

To  assist  program  offieials  in  identifying  potentially  inappropriate  and  fraudulent 
transaetions  in  a  more  timely  manner,  data  mining  teehniques  should  be  used  as  a  regular 
internal  control.  By  implementing  data  mining  tools,  purchase  card  program  officials 
will  be  better  able  to  perform  their  oversight  responsibilities,  take  appropriate  eorreetive 
action  in  a  timely  manner,  and  perform  the  followup  neeessary  for  ensuring  that 


corrective  action  taken  is  appropriate  and  sufficient.  Based  on  the  actions  DoD 
management  has  initiated  or  taken,  this  report  makes  no  recommendation  for  corrective 
action.  With  the  use  of  data  mining  and  other  management  actions,  the  integrity  of  the 
purchase  card  program  along  with  confidence  in  DoD  to  spend  money  prudently  is 
improved. 

Ongoing  Management  Actions.  In  an  effort  to  address  deficiencies  in  the  purchase  card 
program,  the  Under  Secretary  of  Defense  (Comptroller)/Chief  Financial  Officer 
established  in  March  2002  a  Government  Charge  Card  Task  Force  that  would  assess  the 
DoD  purchase  and  travel  card  programs  and  make  recommendations  for  improvements. 
Subsequently,  the  Under  Secretary  of  Defense  for  Acquisition,  Technology,  and  Logistics 
established  the  DoD  Charge  Card  Special  Focus  Group  to  achieve  a  balance  between 
streamlining  business  processes  and  proper  charge  card  use.  An  Integrated  Product  Team 
supports  the  Special  Focus  Group  and  is  responsible  for  resolving  policy  and  process 
issues  related  to  implementation  of  the  recommendations  in  the  DoD  Charge  Card  Task 
Force  Final  Report.  Implementation  of  the  recommendations  in  the  DoD  Charge  Card 
Task  Force  Final  Report  should  assist  in  reducing  the  number  of  questionable  purchase 
card  transactions  discussed  in  this  report. 

The  DoD  Purchase  Card  Program  Office,  along  with  the  Navy,  also  initiated  actions  that 
will  strengthen  internal  controls  by  increasing  the  tools  available  to  DoD  managers. 

Those  actions  include  data  mining  techniques  designed  to  detect  potentially  inappropriate 
and  fraudulent  transactions.  Specifically,  the  Navy  initiated  action  to  establish  an 
automated  and  standardized  process  for  reviewing  high-risk  purchase  card  transactions. 
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Background 


Section  1007,  “Improvements  in  Purchase  Card  Management,”  of  the  National 
Defense  Authorization  Act  for  Fiscal  Year  2003  (Public  Law  107-314, 

December  2,  2002),  states: 

That  the  Inspector  General  of  the  Department  of  Defense  . . .  [will]  perform  periodic 
audits  to  identify— 

(a)  potentially  fraudulent,  improper,  and  abusive  uses  of  purchase  cards; 

(b)  any  patterns  of  improper  cardholder  transactions,  such  as  purchases  of 
prohibited  items;  and 

(c)  categories  of  purchases  that  should  be  made  by  means  other  than  purchase 
cards  in  order  to  better  aggregate  and  obtain  lower  prices. 

In  December  2001,  the  Office  of  the  Inspector  General  of  the  Department  of 
Defense  (OIG  DoD),  the  Defense  Finance  and  Accounting  Service  (DFAS),  and 
the  DoD  Purchase  Card  Program  Management  Office  (PMO)  agreed  to  initiate  an 
automated  oversight  program  that  could  identify  through  data  mining  techniques 
anomalies  in  purchase  card  transaction  data  that  might  indicate  potential  fraud, 
waste,  or  abuse.  This  summary  report  discusses  the  results  of  the  data  mining 
effort,  the  disposition  of  the  referred  transactions,  and  the  systemic  problems 
related  to  the  DoD  Purchase  Card  Program. 

The  Federal  Purchase  Card  Program.  The  purchase  card  is  a  commercial 
charge  card  issued  through  a  Government  contract  to  Federal  agency  employees 
to  pay  for  official  Government  purchases.  The  General  Services  Administration 
(GSA)  is  responsible  for  the  Government  purchase  card  program  and  in  1989 
awarded  the  first  Government-wide  purchase  card  contract.  The  goal  of  the 
purchase  card  program  is  to  increase  the  efficiency  with  which  Federal  agencies 
can  purchase  goods  and  services  directly  from  vendors.  Specifically,  the  purchase 
card  (Figure  1)  enables  agencies  to  expedite  purchases,  streamline  payment 
procedures,  and  reduce  administrative  costs. 


Figure  1.  Government  Purchase  Card 
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The  Federal  Acquisition  Streamlining  Act  of  1994  established  $2,500  as  the 
threshold  for  micropurchases  and  eliminated  most  of  the  procurement  restrictions 
for  purchases  identified  within  that  threshold.  Executive  Order  No.  12931, 
“Federal  Procurement  Reform,”  October  13,  1994,  directs  that  agencies  expand 
the  use  of  the  purchase  cards  and  delegates  micropurchase  authority  to  program 
officials.  In  1995,  the  Federal  Acquisition  Regulation  designated  the  purchase 
card  as  the  preferred  method  for  paying  for  micropurchases. 

The  GSA  purchase  card  program  consists  of  one  contract  with  five  banking 
vendors,  and  each  agency,  according  to  need,  can  choose  one  or  more  of  the 
contracts  for  providing  purchase  cards  to  employees  of  the  Federal  Government. 
The  GSA  reported  that  in  FY  2001  Government  cardholders  made  more  than 
24  million  purchases  valued  at  $13.7  billion.  GSA  further  reported  that  by  using 
the  purchase  card,  the  Government  saved  approximately  $1.3  billion  annually  in 
administrative  costs,  and  DoD  earned  $28  million  in  rebates. 

Purchase  Cards  in  DoD.  The  Under  Secretary  of  Defense  for  Acquisition, 
Technology,  and  Logistics  is  responsible  for  purchase  card  policy  and  oversight, 
and  coordinates  with  the  Under  Secretary  of  Defense  (Comptroller)/Chief 
Financial  Officer  on  purchase  card-related  finance  and  accounting  issues.  In 
March  1998,  the  Deputy  Secretary  of  Defense  centralized  management  for  the 
purchase  card  program  by  establishing  the  PMO  as  the  executive  agent  for  DoD 
purchase  cards.  The  PMO  reports  directly  to  the  Director,  Defense  Procurement 
and  Acquisition  Policy  within  the  Office  of  the  Under  Secretary  of  Defense  for 
Acquisition,  Technology,  and  Logistics.  The  PMO  establishes  the  policies  and 
procedures  for  use  of  the  purchase  cards  within  DoD.  More  specifically,  the 
PMO  coordinates  contract  requirements  with  GSA,  manages  delinquencies, 
standardizes  purchase  card  management  and  reconciliation,  and  establishes 
purchase  card  training  throughout  DoD.  The  PMO  reported  that  in  FY  2002, 
about  214,000  DoD  cardholders  used  the  purchase  card  to  make  approximately 
1 1  million  purchases  valued  at  $6.8  billion. 

Purchase  Card  Program  Responsibilities.  DoD  Components  are  responsible 
for  operating  local  purchase  card  programs  that  support  the  mission  of  each 
organization.  Each  Component  must  appoint  an  agency  or  organizational 
program  coordinator  that  manages  the  day-to-day  activities  and  ensures  the 
overall  integrity  of  the  purchase  card  program.  Program  coordinators  authorize 
purchase  cards  accounts,  set  spending  limits,  establish  supplementary  policies  and 
procedures,  and  monitor  the  use  of  purchase  card  accounts.  Approving  officials 
are  responsible  for  authorizing  and  approving  purchases  as  well  as  certifying 
monthly  billings  for  payment.  Both  the  cardholder  and  the  approving  official 
must  reconcile  purchased  goods  and  services  with  the  bank  statement  before  the 
invoice  can  be  paid. 

Prior  Reviews  and  Identified  Systemic  Issues.  The  General  Accounting  Office 
(GAO)  issued  four  reports  and  participated  in  three  congressional  hearings  that 
relate  to  the  DoD  Purchase  Card  Program.  In  the  reports  issued  between  March 
2002  and  December  2002,  GAO  attributed  the  vulnerability  of  the  DoD  Purchase 
Card  Program  for  the  potentially  abusive  and  fraudulent  purchase  card 
transactions  to  a  weak  internal  control  environment  and  breakdown  of  key 
internal  control  activities. 
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Between  FY  1996  and  FY  2002,  IG  DoD  and  the  Military  Department  audit 
organizations  issued  more  than  300  audit  reports  on  purchase  cards.  IG  DoD 
Report  No.  D-2002-029,  “DoD  Purchase  Card  Program  Audit  Coverage,” 
December  27,  2001,  identifies  systemic  issues  in  the  purchase  card  program  that 
include  account  reconciliation  and  certification,  administrative  controls, 
management  oversight,  property  accountability,  purchase  card  use,  separation  of 
duties,  and  training. 

Congressional  Interest.  On  October  8,  2002,  the  U.S.  House  of  Representatives 
Committee  on  Government  Reform,  Subcommittee  on  Government  Efficiency, 
Financial  Management,  and  Intergovernmental  Relations  held  a  hearing  regarding 
purchase  card  use  and  abuse.  The  hearing,  the  fourth  in  a  series  of  charge  card 
hearings,  highlighted  the  need  for  continued  program  oversight,  implementation 
of  effective  internal  controls,  and  accountability.  Senator  Charles  E.  Grassley 
challenged  the  IG  DoD  to  assist  DoD  with  oversight  efforts  and  spoke  of  a  real¬ 
time,  continuous,  and  sustained  data  mining  operation  as  a  means  of  monitoring 
charge  card  transactions.  Senator  Grassley  stressed  that,  with  constant 
surveillance,  credit  card  abuse  either  will  cease  or  at  the  very  least,  be  held  to  a 
minimum. 

Charge  Card  Task  Force.  The  Under  Secretary  of  Defense  (Comptroller)/Chief 
Financial  Officer  established  a  Government  Charge  Card  Task  Force  in 
March  2002  for  assessing  DoD  purchase  and  travel  card  programs  and 
recommending  improvements.  The  task  force  evaluation  focused  on  three  key 
areas.  Those  areas  of  evaluation  include  management  emphasis  and 
organizational  culture,  compliance,  and  process  and  workforce  developments.  On 
June  27,  2002,  the  task  force  issued  the  DoD  Charge  Card  Task  Force  Final 
Report,  which  contains  25  recommendations  for  improving  the  travel  and 
purchase  card  programs.  The  report  recommends  strengthening  internal  controls 
and  increasing  tools  available  to  managers  for  enforcing  the  controls,  including 
the  use  of  data  mining  technologies  that  could  detect  fraudulent  or  abusive 
purchase  and  travel  card  transactions. 

Data  Mining.  Data  mining  is  the  process  that  discovers  correlations,  patterns, 
and  trends  by  sifting  through  large  repositories  of  data  using  pattern  recognition 
technologies  and  statistical  techniques.  Data  mining  tools  help  predict  future 
trends  and  behaviors  as  well  as  allow  businesses  to  make  proactive,  knowledge- 
based  decisions.  Used  primarily  by  companies  with  a  strong  customer  focus  such 
as  retail,  financial,  communications,  and  marketing  organizations,  data  mining  has 
a  variety  of  applications.  Data  mining  is  useful  for  identifying  transactions  that 
have  a  higher  risk  of  being  inappropriate.  For  example,  transactions  made  by  a 
medical  facility  to  an  upholsterer  should  be  looked  at  more  closely  than 
transactions  the  medical  facility  made  to  a  pharmaceutical  supplier. 
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Objectives 


The  objective  of  the  joint  effort  was  to  determine  whether  data  mining  techniques 
led  to  the  identification  of  potentially  problematic  transactions.  An  additional 
objective  was  to  identify  ways  to  both  strengthen  internal  controls  and  provide 
tools  that  managers  could  use  for  enforcing  those  controls. 
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Purchase  Card  Transactions 

Analysis  of  purchase  card  transactions  identified  that  1 82  of  the 
1,357  cardholders  reviewed  had  potentially  used  their  purchase  cards 
inappropriately  or  fraudulently.  The  potential  misuse  occurred  because 
DoD  did  not  implement  adequate  internal  controls  that  would  preclude  and 
quickly  detect  potentially  inappropriate  or  fraudulent  use.  Moreover, 
management  lacked  tools  such  as  data  mining  techniques  designed  to 
maximize  existing  resources  for  overseeing  the  purchase  card  program  and 
identify  transactions  that  have  a  higher  risk  for  abuse  and  fraud.  As  a 
result,  the  182  cardholders  expended  scarce  resources  of  about  $5  million 
in  transactions  that  were  potentially  inappropriate  and  fraudulent.  With 
the  use  of  data  mining  and  other  management  controls,  the  integrity  of  the 
purchase  card  program  along  with  confidence  in  DoD  to  spend  money 
prudently  is  improved. 


Joint  Purchase  Card  Project 


In  December  2001,  the  IG  DoD,  DFAS,  and  the  PMO  agreed  to  begin  a  joint 
purchase  card  project  that  would  use  data  mining  techniques  to  detect  purchase 
card  transactions  that  appeared  potentially  inappropriate  or  fraudulent  and 
warranted  additional  field  research.  Purchase  card  experts  from  the  audit  and 
investigative  communities  met  to  develop  and  prioritize  indicators  that  could 
detect  anomalies  in  purchase  card  transaction  data.  Those  experts  coded  the 
indicators,  and  combinations  of  the  indicators  were  applied  to  purchase  card 
transaction  data  from  July  1,  2001,  through  December  31,  2001.  The  process 
resulted  in  selection  of  13,052  purchase  card  transactions  for  review.  The 
transactions  totaled  approximately  $38.3  million  and  related  to  2,036  DoD 
purchase  cardholders. 

The  IG  DoD  then  provided  to  each  of  the  Services  and  the  Defense  agencies  a 
cardholder  profile.  The  profile  contained  flagged  transactions  as  well  as  the 
transactions  the  cardholders  made  from  October  1,  2000,  through  December  31, 
2001.  Table  1  shows  the  cardholders  and  transactions  flagged  for  review  as  well 
as  the  scope  of  work  performed  by  each  of  the  Services  and  the  Defense  agencies. 
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Table  1.  Purchase  Cardholders  and  Transactions  Selected  for  Review  and 

Work  Performed 


Agency 

Flagged 

Cardholders 

Flagged 

Transactions 

Related 

Transactions 

Total 

Transactions 
Available  for 
Review 

Cardholders 

Reviewed 

Transactions 

Reviewed 

Army 

922 

6,377 

196,181 

202,558 

674 

4,624 

Navy 

485 

2,809 

193,699 

196,508 

282 

9,043 

Air  Force 

492 

2,776 

116,878 

119,654 

264 

2,625 

Other  Defense 

137 

1,090 

42,689 

43,779 

137 

1,330 

Total 

2,036 

13,052 

549,447 

562,499 

1,357 

17,622 

Inappropriate  and  Potentially  Fraudulent  Transactions 


Analysis  of  purchase  card  transactions  made  by  1,357  DoD  purchase  cardholders 
identified  1 82  cardholders  that  potentially  used  their  purchase  cards 
inappropriately  or  fraudulently.  Table  2  shows  the  results  as  reported  by  each 
Service  and  Defense  agency. 

Table  2.  Purchase  Cardholders  with  Inappropriate  Card  Use  and  Those 
Referred  for  Criminal  Investigations 


Cardholders 

Reviewed 

With 

Inappropriate 
Card  Use 

Referred  to 
Investigations 

Army 

674 

84 

4 

Navy 

282 

36 

8 

Air  Force 

264 

17 

24 

Defense  Agencies 

137 

4 

5 

Total 

1,357 

141 

41 

Army.  The  Army  Audit  Agency  and  internal  review  personnel  reviewed 
674  cardholders  and  4,624  purchase  card  transactions  totaling  approximately 
$20. 1  million.  The  Army  identified  88  cardholders  and  284  transactions  valued  at 
approximately  $520,000  that  were  potentially  inappropriate  or  fraudulent. 
Examples  of  reported  problems  follow. 
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•  A  cardholder  purchased  a  Santa  suit  for  $232  with  the  Government 
purchase  card. 

•  A  cardholder  inappropriately  rented  a  vehicle  for  $910  using  the 
Government  purchase  card. 

•  A  cardholder  accessed  possible  pornographic  sites  and  sports-related  Web 
sites  with  the  Government  purchase  card. 

Navy.  The  Naval  Audit  Service  reviewed  282  cardholders  and  9,043  purchase 
card  transactions  totaling  approximately  $5.95  rnillion.  The  Naval  Audit  Service 
identified  44  cardholders  and  7,758  transactions  valued  at  approximately 
$3.17  million  that  were  potentially  inappropriate  or  fraudulent.  Examples  of 
reported  problems  follow. 

•  At  a  Navy  facility,  building  renovations  budgeted  at  more  than  $500,000, 
were  paid  for  with  the  Government  purchase  card  by  splitting  the  project 
into  smaller  transactions  to  stay  below  the  $2,500  micropurchase 
threshold. 

•  One  Navy  cardholder  used  the  Government  purchase  card  to  purchase  two 
automobiles,  surgical  enhancements,  and  a  motorcycle.  The  cardholder 
made  59  fraudulent  purchases  that  totaled  more  than  $132,000. 

Air  Force.  The  Air  Force  Audit  Agency  reviewed  264  cardholders  and 
2,625  purchase  card  transactions  totaling  approximately  $4.26  million.  The  Air 
Force  Audit  Agency  identified  41  cardholders  and  339  transactions  totaling  about 
$554,000  that  were  potentially  inappropriate  or  fraudulent.  Examples  of  reported 
problems  follow. 

•  A  cardholder  purchased  personal  goods  and  services  such  as  meals, 
gasoline,  and  recreational  activities  with  the  Government  purchase  card. 
The  cardholder  made  29  inappropriate  or  unauthorized  purchases  that 
totaled  about  $6,000. 

•  Unauthorized  individuals  used  Air  Force  purchase  card  account  numbers 
for  155  purchase  transactions  totaling  $30,196.  The  cardholders 
successfully  disputed  1 1 8  of  those  charges,  resulting  in  credits  totaling 
$28,365  (94  percent  of  the  total  loss).  The  transactions  included  charges 
to  sexually  explicit  Internet  Web  sites  and  Internet  gambling  sites. 

Air  Force  auditors  referred  the  transactions  for  further  review  to  the 
Air  Force  Office  of  Special  Investigation.  Air  Force  Office  of  Special 
Investigation  officials  confirmed  that  the  majority  of  the  charges  resulted 
from  theft  of  the  purchase  card  numbers.  The  Air  Force  Office  of  Special 
Investigation  and  Defense  Criminal  Investigative  Service  were  reviewing 


Of  the  7,758  transactions  the  Navy  identified  as  potentially  inappropriate  or  fraudulent,  7,667  transactions 
(99  percent)  were  related  to  8  cardholders  referred  to  investigations  from  October  1,  2000,  through 
December  31,  2001. 
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the  transactions  to  determine  whether  any  of  the  cardholders  were 
responsible  and  whether  commercial  entities  intentionally  billed 
fraudulent  charges  to  Air  Force  purchase  cards. 

•  One  cardholder  split  a  $9,13 1  requirement  into  four  separate  transactions 
within  the  same  day  to  purchase  new  uniforms  for  military  personnel.  In 
that  instance,  the  cardholder  believed  the  mission  was  accomplished  but 
disregarded  established  policy  by  splitting  requirements  without  review  by 
a  warranted  contracting  officer  to  determine  whether  lower  prices  could  be 
obtained  or  to  ensure  that  the  purchases  met  statutory  requirements. 

Defense  Agencies.  The  IG  DoD  and  Defense  agency  personnel  reviewed 
137  cardholders  and  1,330  purchase  card  transactions  totaling  approximately 
$3.11  million.  The  Defense  agencies  identified  9  cardholders  and  90  transactions 
totaling  approximately  $840,000  that  were  potentially  inappropriate  or  fraudulent. 
Examples  of  reported  problems  follow. 

•  Data  mining  techniques  identified  6  Washington  Headquarters  Service 
cardholders  and  79  purchase  card  transactions  for  review.  To  obtain 
additional  confidence  in  the  audit  results,  the  audit  team  reviewed 
additional  transactions  for  each  cardholder.  After  questionable 
transactions  were  identified,  nine  additional  cardholders  at  Washington 
Headquarters  Services  were  reviewed.  The  review  resulted  in  $1.7  million 
in  fraudulent  purchases  from  May  1999  through  August  2002  and  at  least 
$201,000  in  additional  abusive,  improper,  and  unauthorized  purchases  by 
employees.  Of  those  cardholders  reviewed,  two  Washington  Headquarters 
Services  employees  used  the  purchase  card  to  make  about  500  fraudulent 
purchases  of  goods  and  services  from  a  company  created  solely  to 
facilitate  fraud.  DoD  did  not  receive  any  goods  or  services  from  the  sales 
charged  to  the  card.  The  two  cardholders  plead  guilty  to  the  charge  of 
theft  of  Government  property.  One  cardholder  was  imprisoned  and  the 
other  was  sentenced  to  probation  to  include  home  confinement.  Both  were 
ordered  to  make  full  restitution  to  the  Government. 

•  One  cardholder  used  the  purchase  card  52  times  in  an  8-week  period  to 
make  a  single  purchase  for  more  than  $551 ,000.  The  cardholder 
potentially  used  the  Government  purchase  card  inappropriately  to 
circumvent  DoD  acquisition  regulations.  The  cardholder  did  so  by 
splitting  a  single  purchase  into  numerous  transactions  below  the 
micropurchase  threshold. 

Purchase  Card  Controls  and  Oversight 


GAO  and  IG  DoD  prior  audits  and  reviews  identified  that  inappropriate  and 
fraudulent  purchase  card  transactions  generally  occurred  because  local 
organizations  failed  to  follow  operating  policies  and  procedures  for  the 
Government  purchase  card  program.  Specifically,  the  overall  control 
environment  was  inadequate,  the  review  and  approval  process  was  inefficient,  and 
the  program  monitoring  and  oversight  was  ineffective.  Management  also  did  not 
dedicate  adequate  resources  that  would  ensure  compliance  with  internal  controls. 
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and  approving  officials  did  not  have  tools,  such  as  data  mining  techniques,  that 
could  identify  transactions  with  a  higher  risk  of  being  potentially  fraudulent, 
wasteful,  or  abusive. 

DoD  management  needs  to  establish  and  maintain  a  culture  that  promotes  a 
positive  and  supportive  attitude  toward  internal  controls  and  conscientious 
management.  Such  an  environment  is  the  foundation  for  all  other  control 
standards  that  provide  discipline,  structure,  and  a  climate  that  influences  quality. 
To  correct  purchase  card  program  deficiencies,  DoD  should  as  a  part  of  its  regular 
control  activities  implement  automated  data  mining  tools  for  continuously 
monitoring  transactions  for  potentially  fraudulent,  wasteful,  and  abusive  activity. 
By  using  data  mining  to  assign  risk  to  individual  transactions,  managers  and 
supervisors  are  forced  to  perform  their  oversight  responsibilities,  take  appropriate 
actions  to  correct  improper  use,  and  perform  followup.  In  addition,  the  use  of 
ongoing  monitoring  as  a  matter  of  normal  operations  reduces  the  chance  that 
cardholders  will  act  improperly  without  detection.  In  recent  testimony  before  the 
Subcommittee  on  Technology,  Information  Policy,  Intergovernmental  Relations, 
and  the  Census,  Committee  on  Government  Reform,  House  of  Representatives, 
GAO  supported  the  need  for  a  continuous  monitoring  system  and  identified  data 
mining  as  a  critical  audit  and  investigative  tool,  stating  that  the  results  of  data 
mining  show  “real  consequence  or  effect  of  breakdowns  in  internal  controls.” 

Management  Actions  to  Implement  a  Continuous  Monitoring 
Tool 


DoD  Improvements  During  This  Review.  In  March  2003,  the  Under  Secretary 
of  Defense  for  Acquisition,  Technology,  and  Logistics  established  the  DoD 
Charge  Card  Special  Focus  Group  to  achieve  a  balance  between  streamlining 
business  processes  and  proper  charge  card  use.  An  Integrated  Product  Team 
supports  the  Special  Focus  Group  and  is  responsible  for  resolving  policy  and 
process  issues  related  to  the  implementation  of  the  recommendations  in  the  DoD 
Charge  Card  Task  Force  Final  Report.  One  task  that  the  focus  group  undertook 
was  to  identify  practices  that  would  best  strengthen  internal  controls  as  well  as 
increase  available  tools  for  managers  to  enforce  internal  controls.  Part  of  the  task 
included  using  data  mining  techniques  that  could  detect  purchase  and  travel  card 
transactions  with  a  high  risk  of  being  potentially  fraudulent  or  abusive. 

Navy  Action.  Based  on  recommendations  by  the  IG  DoD,  the  Navy  initiated 
action  to  address  purchase  card  fraud,  misuse,  and  abuse  by  establishing  an 
automated  and  standardized  process  for  reviewing  high-risk  purchase  card 
transactions. 

Both  the  Navy  and  IG  DoD  envision  a  prototype  system  that  would  send  an 
automated  e-mail  to  the  appropriate  approving  official  requesting  additional 
information  for  assessing  the  appropriateness  of  a  transaction.  The  approving 
official’s  response  to  questions  will  populate  a  database,  which  can  be  used  for 
reporting  trends,  identifying  deficiencies,  and  providing  data  for  fraud  or  misuse 
improvement. 
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The  first  phase  of  the  prototype  focuses  on  approving  official  review  of 
cardholder  transactions,  and  the  U.S.  Marine  Corps  is  field  testing  a  pilot  program 
at  Camp  LeJeune,  North  Carolina.  The  prototype  system,  although  being 
developed  by  the  Navy,  has  applicability  throughout  DoD. 

Based  on  the  actions  the  DoD  Purchase  Card  PMO  and  the  Navy  have  taken  or 
initiated,  this  report  makes  no  recommendations  for  additional  corrective  action. 
See  Figure  2  for  a  diagram  of  the  continuous  monitoring  system. 


Bank 

Data 


1 


1.  Bank  (transaction) 
data  are  extracted, 
transformed,  and 
transported  into 
fraud  detection  data 
storage  location. 


Data 

Storage 


2.  Data  mining  and 
business  rules  are 
applied  against  data 
to  select  and  subset 
suspicious 
transactions. 


E-mail 

Reports 


Action 

Required 


Transaction  and  checklist  results  returned  to 
data  storage.  In  further  cycles,  the  information 
is  also  incorporated  and  utilized  in  step  2  to 
look  for  possible  manager  collusion.  If  a 
pattern  of  possible  collusion  is  detected, 
additional  notification  and  report  is  submitted  to 
higher-level  manager  for  action. 


Web-based 

response 


Approving  Officials,  Agency 
Program  Coordinators,  and 
managers  investigate  transactions 
and  fill  out  Web-based  survey 
responses  that  detail  steps  for 
verifying  transactions. 


3.  Approving  Officials,  Agency  Program 
Coordinators,  and  auditors  are  notified  by 
e-mail  about  suspicious  employee  transactions. 


Figure  2.  Continuous  Monitoring  System 
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Conclusion 


The  data  mining  effort  identified  transactions  that  were  inappropriate  or 
potentially  fraudulent.  Because  DoD  purchase  cardholders  continue  to  misuse  the 
purchase  card,  continuous  monitoring  of  the  program  is  needed  to  maintain  its 
credibility  with  Congress  and  the  American  public  as  a  cost-efficient  method  of 
procurement.  To  ensure  proper  stewardship  of  the  resources,  DoD  must 
implement  effective  internal  controls  and  comply  with  established  guidelines  and 
standards.  We  believe  effective  controls  can  be  facilitated  by  developing  an 
automated  oversight  program  using  data  mining  techniques  that  can  detect 
potentially  fraudulent,  wasteful,  or  abusive  purchase  card  transactions.  Increased 
surveillance  can  benefit  management,  allowing  them  to  focus  scarce  resources  on 
purchase  card  transactions  with  a  higher  risk  of  being  potentially  abusive  or 
fraudulent.  Based  on  the  actions  DoD  management  has  initiated  or  taken,  this 
report  makes  no  recommendations  for  corrective  action.  The  tool  can  eventually 
be  refined  and  used  to  develop  metrics  that  will  assist  management  in  resolving 
any  weaknesses  of  internal  controls  as  well  as  take  timely  action  to  correct 
deficiencies.  Table  3  shows  a  comparison  between  the  traditional  oversight 
method  that  DoD  currently  uses  and  a  continuous  monitoring  approach. 

Table  3.  Traditional  Oversight  versus  Continuous  Monitoring 


Traditional  Oversight  Method 

Continuous  Monitoring  Approach 

•  Manual  inquiries  for 
documentation 

•  Automated  e-mails 

•  Standard  response  formats 

•  Database  format  that  facilitates  data 
mining 

•  Responses  often  vague  with 
little  value 

•  Responses  objective 

•  Querying  and  tracking  mechanisms  in 
place 

•  Automated  analysis  capabilities 

•  Transactions  dated  (1  to  2 
years  old) 

•  Most  recent  month’s  transactions 

•  Top  down  inquiries 

•  Bottom  up  reporting  to  approving 
official 

11 


Appendix  A.  Scope  and  Methodology 


We  conducted  this  joint  review  with  the  Army  Audit  Agency,  the  Naval  Audit 
Service,  the  Air  Force  Audit  Agency,  and  other  Defense  agency  internal  review 
officials.  We  did  not  request  that  the  Services  or  Defense  agencies  issue  separate 
reports  or  focus  on  additional  causative  research. 

For  this  review,  purchase  card  experts  from  the  audit  and  investigative 
communities  met  to  develop  and  prioritize  indicators  that  could  detect  anomalies 
in  purchase  card  transaction  data.  DFAS  Internal  Review  coded  the  indicators, 
and  combinations  of  the  indicators  were  applied  to  purchase  card  transaction  data 
from  July  1,  2001,  through  December  31,  2001.  As  a  result,  we  identified  for 
review  13,052  purchase  card  transactions,  totaling  approximately  $38.3  million. 
The  13,052  transactions  related  to  2,036  cardholders  and  1,604  approving 
officials  in  752  cities.  See  Appendix  B  for  the  scope  of  our  review  of  the  DoD 
Purchase  Card  Program  based  on  location.  For  the  purposes  of  this  review,  we 
excluded  from  the  purchase  card  data  all  nonappropriated  fund  and  overseas 
transactions. 

The  IG  DoD  provided  each  of  the  Services  and  the  Defense  agencies  with  a 
cardholder  profile.  The  cardholder  profile  contained  the  flagged  transactions  as 
well  as  transactions  cardholders  made  from  October  1,  2000,  through 
December  3 1 ,  200 1 . 

During  this  effort,  we  coordinated  execution  of  the  review  with  the  Army  Audit 
Agency,  the  Naval  Audit  Service,  the  Air  Force  Audit  Agency,  and  other  Defense 
agency  internal  review  officials.  We  also  closely  coordinated  our  efforts  with 
personnel  from  the  Defense  Criminal  Investigative  Service,  Military  Criminal 
Investigative  Organizations,  the  PMO,  GAO,  and  GSA. 

We  performed  this  review  from  May  2002  through  June  2003.  Because  this 
report  is  not  an  audit  but  is  instead  a  summary  of  data,  we  did  not  meet  generally 
accepted  government  auditing  standards  nor  did  we  fully  meet  IG  DoD  audit 
standards.  Specifically,  we  did  not  meet  the  evidence  standard  as  set  forth  in 
Generally  Accepted  Government  Auditing  Standard  6.46  that  we  have 
incorporated  into  our  audit  standards.  We  were  not  able  to  fiilly  verify  all  the  data 
provided  and  contained  in  the  report,  and  an  experienced  auditor  having  no 
previous  connection  with  this  review  may  have  difficulty  ascertaining  from  the 
working  papers,  evidence  that  supports  the  conclusions  and  judgments.  However, 
we  believe  that  the  available  verifiable  information  supports  the  finding  and 
conclusions  in  this  report. 

We  did  not  review  the  management  control  program  because  DoD  identified  the 
purchase  card  program  as  a  systemic  weakness  in  the  FY  2002  Performance  and 
Accountability  Report.  The  FY  2002  Performance  and  Accountability  Report 
recognizes  that  past  audit  coverage  revealed  that  misuse,  abuse,  and  fraud  was 
caused  by  inadequate  DoD  emphasis  on  proper  use,  poor  controls,  and  lax 
oversight  of  purchase  cards.  We  did  not  assess  management’s  self-evaluation. 
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Use  of  Computer-Processed  Data.  To  achieve  the  objective,  we  relied  on 
computer-processed  data  from  U.S.  Bank  and  Citibank,  which  were  provided  to 
us  by  the  Defense  Manpower  Data  Center.  The  DFAS  Internal  Review  personnel 
applied  data  mining  techniques  that  identified  purchase  card  transactions  with  a 
higher  probability  for  abuse  and  fraud.  For  example,  we  identified  some 
inconsistencies  in  the  data  such  as  duplicate  cardholders,  incorrect  single 
micropurchase  limits,  and  monthly  spending  limits. 

Although  we  relied  on  the  data,  we  did  not  perform  any  formal  reliability 
assessment  of  the  computer-processed  data.  We  were,  however,  able  to  establish 
data  reliability  for  the  information  by  comparing  purchase  card  transaction  data  to 
source  documentation.  The  comparison  disclosed  that  the  data  were  sufficient  to 
support  the  conclusions. 

Use  of  Technical  Assistance.  We  received  technical  assistance  from  the  Defense 
Manpower  Data  Center.  The  Defense  Manpower  Data  Center  provided  us  with 
the  cardholder  and  transaction  data  from  July  1,  2001,  through  December  31, 
2001.  The  Defense  Manpower  Data  Center  is  responsible  for  maintaining  the 
DoD  purchase  card  data,  which  are  organized  in  three  large  repositories, 
categorized  by  transaction,  cardholder,  and  approving  official. 

We  also  received  technical  assistance  from  DFAS  Internal  Review.  DFAS  coded 
the  fraud  indicators  developed  by  the  subject  matter  experts  and  then  applied 
those  indicators  to  purchase  card  transactions  that  could  identify  purchases  with  a 
greater  likelihood  of  being  potentially  fraudulent  or  abusive. 

General  Accounting  Office  High-Risk  Area.  The  GAO  has  identified  several 
high-risk  areas.  This  report  provides  coverage  on  the  DoD  high-risk  area  to 
improve  processes  and  controls  to  reduce  contract  risk. 

Prior  Coverage 


Between  FY  1996  and  FY  2002,  more  than  300  audit  reports  identified  a  wide 
range  of  implementation  problems  in  the  DoD  Purchase  Card  Program. 

General  Accounting  Office.  GAO  issued  four  reports  and  participated  in  three 
testimonies  relating  to  the  DoD  Purchase  Card  Program.  The  most  recent  reports 
are  GAO  Report  No.  GAO-03-292,  “Purchase  Cards:  Control  Weaknesses  Leave 
the  Air  Force  Vulnerable  to  Fraud,  Waste,  and  Abuse,”  December  20,  2002,  and 
GAO  Report  No.  GAO-03-154T,  “Purchase  Cards:  Navy  Vulnerable  to  Fraud, 
Waste,  and  Abuse  but  is  Taking  Action  to  Resolve  Control  Weaknesses,” 

October  8,  2002.  In  addition,  GAO  issued  a  report  on  data  mining,  GAO  Report 
No.  GAO-03-591T,  “Data  Mining:  Results  and  Challenges  for  Government 
Program  Audits  and  Investigations,”  March  25,  2003.  GAO  reports  can  be 
accessed  in  the  Internet  at  http://www.gao.gov. 

DoD  Audit  Organizations.  The  IG  DoD  and  audit  organizations  in  Military 
Departments  and  the  Defense  agencies  issued  more  than  300  reports  on  purchase 
cards  between  FY  1996  and  FY  2002.  IG  DoD  Report  No.  D-2002-0029, 
“Summary  of  DoD  Purchase  Card  Program  Audit  Coverage,”  December  27, 
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2001,  identifies  systemic  issues  with  the  program.  IG  DoD  Report 

No.  D-2002-075,  “Controls  Over  the  DoD  Purchase  Card  Program,”  March  29, 

2002,  identifies  specific  risk  factors  existing  in  FY  2001  that  required  more 
proactive  oversight.  IG  DoD  reports  can  be  accessed  on  the  Internet  at 
http://dodig.osd.mil/audit/reports.  The  Military  Departments  and  other  Defense 
agency  reports  can  be  viewed  from  the  DoD  Internet  Web  site  at 
http://www.defenselink.mil/. 
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Director,  Purchase  Card  Joint  Program  Management  Office 
Under  Secretary  of  Defense  (Comptroller)/Chief  Financial  Officer 
Deputy  Chief  Financial  Officer 
Deputy  Comptroller  (Program/Budget) 


Department  of  the  Army 

Assistant  Secretary  of  the  Army  (Financial  Management  and  Comptroller) 
Auditor  General,  Department  of  the  Army 


Department  of  the  Navy 

Assistant  Secretary  of  the  Navy  (Financial  Management  and  Comptroller) 

Naval  Inspector  General 

Auditor  General,  Department  of  the  Navy 


Department  of  the  Air  Force 

Assistant  Secretary  of  the  Air  Force  (Financial  Management  and  Comptroller) 
Auditor  General,  Department  of  the  Air  Force 


Other  Defense  Organizations 

Director,  Defense  Commissary  Agency 
Director,  Defense  Contract  Management  Agency 
Director,  Defense  Finance  and  Accounting  Service 
Director,  Defense  Information  Systems  Agency 
Director,  Defense  Intelligence  Agency 
Director,  Defense  Logistics  Agency 
Director,  Defense  Threat  Reduction  Agency 
Director,  DoD  Education  Activity 
Director,  DoD  Human  Resources  Activity 
Director,  Tricare  Management  Activity 
Director,  National  Imagery  and  Mapping  Agency 
Director,  National  Reconnaissance  Organization 
Director,  National  Security  Agency 
Director,  Washington  Headquarters  Service 
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Non-Defense  Organization 

Office  of  Management  and  Budget 


Congressional  Committees  and  Subcommittees,  Chairman  and 
Ranking  Minority  Member 

Senate  Committee  on  Appropriations 

Senate  Subeommittee  on  Defense,  Committee  on  Appropriations 
Senate  Committee  on  Armed  Serviees 
Senate  Committee  on  Governmental  Affairs 
House  Committee  on  Appropriations 

House  Subcommittee  on  Defense,  Committee  on  Appropriations 
House  Committee  on  Armed  Services 
House  Committee  on  Government  Reform 

House  Subcommittee  on  Government  Efficieney  and  Finaneial  Management,  Committee 
on  Government  Reform 

House  Subcommittee  on  National  Seeurity,  Emerging  Threats,  and  International 
Relations,  Committee  on  Government  Reform 
House  Subcommittee  on  Teehnology,  Information  Poliey,  Intergovernmental  Relations, 
and  the  Census,  Committee  on  Government  Reform 
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Team  Members 

The  Contract  Management  Directorate,  Office  of  the  Deputy  Inspector  General 
for  Auditing  of  the  Department  of  Defense  prepared  this  report.  Personnel  of  the 
Office  of  the  Inspector  General  of  the  Department  of  Defense  who  contributed  to 
the  report  are  listed  below. 

Colonel  William  J.  Kelley 
Lisa  M.  Such 
Brett  Ward 
William  H.  Sterling 
Michael  L.  Davitt 
Dennis  R.  Wokeck 
Pamela  S.  Varner 
Curtis  P.  Greene 
Justin  C.  Husar 
Angela  Kendera 
Carol  Brink-Meissner 
Robert  K.  West 
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